CVE-2026-19234

HighCVSS 8.2/10Last modified Aug 26, 2026

Description

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
IBM	Power Systems Firmware	FW1120.00; >= FW1110.00, <= FW1110.30; >= FW1060.00, <= FW1060.80

References

https://www.ibm.com/support/pages/node/7283221Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Aug 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-19244.3The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This i CVE-2026-192436.3A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of CVE-2026-192444.7A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agen CVE-2026-192453.3A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent CVE-2026-192466.3A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function _download_image_data_url of the file nanobot/provider CVE-2026-192487.1QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.CVE-2026-19254.3The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing c CVE-2026-192515.3The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to CVE-2026-192538.7The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routi CVE-2026-192595.3A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMapping_varAccessSpecToObje CVE-2026-19265.3The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2026-192637.3A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown fu